Bug 945294 - Add a missing is<JSFunction> check to annotateGetPropertyCache. r=bhackett

--HG--
extra : rebase_source : 908712a8afa11ce5ce32311befba30edd86a6128
Bug 945406 - Move maybeAddOsrTypeBarriers calls from traverseBytecode to IonBuilder::build. r=bhackett

--HG--
extra : rebase_source : 17730207896800422129ecca46c2eb06ca1f7859